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ABSTRACT : 

A method for secure accounting and auditing of a communications network operates in 
an environment in which many servers serve an even larger number of clients (e.g. 
the web) , and are required to meter the interaction between servers and clients 
(e.g. counting the number of clients that were served by a server) . The method 
(metering process) is very efficient and does not require extensive usage of any 
new communication channels. The metering is secure against fraud attempts by 
servers which inflate the number of their clients and against clients that attempt 
to disrupt the metering process. Several secure and efficient constructions of this 
method are based on efficient cryptographic techniques, are also very accurate, and 
preserver the privacy of the clients. 
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L2: Entry 28 of 48 



File: USPT 



Apr 25, 2000 



DOCUMENT- IDENTIFIER: US 6055508 A 

TITLE: Method for secure accounting and auditing on a communications network 
Brief Summary Text (16) : 

The Internet is based on packet switching, i.e. there is no dedicated path between 
two parties that are communicating through the Internet, but rather each packet of 
information is routed separately. The Internet is essentially a network of networks 
and packets are typically routed through several different networks. These 
properties complicate pricing and accounting mechanisms for Internet usage, and 
indeed the most common pricing method is to charge a fixed price which is 
independent of the actual number of packets which are transferred. Pricing theory 
based analysis indicates that pricing Internet services according to the actual 
usage (at least at times of network congestion) is superior in terms of network 
efficiency. Usage based pricing has a disadvantage of incurring accounting and 
billing costs. It is impractical to create detailed account reports (similar to 
telephone accounts) due to the huge number of packets. Some are suggesting 
measuring usage using sampling or only at times of congestion (however, even 
producing reports for a sample of say, 1/1000 of the packets creates inconceivably 
large reports) . MacKie -Mason and Varian also expect breakthroughs in the area of 
in-line distributed accounting that will lower the costs of Internet accounting . 
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ART-UNIT: 267 

PRIMARY -EXAMINER: Chin; Wellington 
ASSISTANT-EXAMINER: Shankar; Vijay 



ABSTRACT : 

During an execution of communications between an originating terminal and a 
receiving terminal which are connected through an ISDN, when an item of information 
saying that a rate at which charges for the communications are shared between these 
terminals is changed to a given rate is transmitted from either the originating 
terminal or the receiving terminal to the ISDN, the communication charges after 
transmitting this item of information are imposed on the originating terminal 
and/or the receiving terminal in accordance with this rate presented. If an 
agreement of the other terminal is not obtained on this occasion, the charges are 
imposed on the originating terminal and/or the receiving terminal in accordance 
with an original accounting rate or the rate presented from the other terminal. 

14 Claims, 33 Drawing figures 
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L6: Entry 304 of 344 



File: USPT 



Feb 11, 1997 



DOCUMENT- IDENTIFIER: US 5602907 A 

TITLE: Method and system for accounting communication charges 
Brief Summary Text (3) : 

The present invention relates to an accounting method for sharing charges for 
services of a communications network with an originating user and/or a receiving 
user. The communications network to which the present invention is applied is a 
communications network in which the service charges for the use thereof are imposed 
and includes any kinds of communications networks such as an analog telephone 
network-and a data communications network like a packet communications network and 
an ISDN (Integrated Services Digital Network) . 

Brief Summary Text (5) : 

In recent years, there have been developed data communications services via a data 
communications network such as a packet communications network and an ISDN. In such 
data communications services, as in the same way with the communications services 
via an analog telephone network, there is adopted a "connection-oriented" 
communications system that a data path is preset before data communications take 
place. FIG. 32 is a time arrow diagram showing a call setting sequence in this 
conventional communications system. Note that the network is illustrated in the 
form of one point in FIG. 32 . As a matter of fact, however, this network is 
constructed of a plurality of switches and trunk lines for relaying these switches 
in all directions. 

Brief Summary Text (7) : 

According to the accounting system of the charges (talk charges) for services of 
the communications network in the above-mentioned "connection-oriented" 
communications system, normally, the communications network service charges (talk 
charges) are calculated based on a quantity of receiving cells on the receiving 
user, and the charges are imposed on the originating user. Further, in the analog 
telephone network, there is spread a "collect call service" in which the 
communications network service charges (talk charges) are imposed on the receiving 
user with an agreement between the originating and receiving users when setting the 
call. Moreover, an accounting system wherein the charges are imposed on both of the 
originating user and the receiving user in accordance with a fixed rate is proposed 
(see Japanese Patent Laid-Open Publication No. 61-146059) . 

Brief Summary Text (8) : 

By the way, for instance, if the originating and receiving users offer information 
exhibiting high added values to each other, it is rational that the (originating 
and receiving) users themselves flexibly determine a share of burden of the 
communications network service charges in accordance with a high-and-low balance of 
the added values of the information offered by each other. 

Brief Summary Text (9) : 

In the conventional accounting system, however, the originating or receiving user 
is able to only determine which user is burdened with the charges but can not 
arbitrarily set a sharing rate thereof. Accordingly, the users do nothing but 
accept the burden of irrational communications network service charges . Note that 
there is caused such troublesomeness that the communications network service 
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charges have to be cleared off between the users in an ex-post -facto manner. This 
is a first problem inherent in the conventional accounting system. 

Brief Summary Text (10) : 

Next, in the conventional accounting system, the accounting destination can be 
determined only when setting the call. Hence, even when there arises a necessity 
for changing accounting specification (an accounting destination and/or an 
accounting share) in the middle of the communications, the accounting specification 
have to be accepted as they are, or the call has to be reset on another occasion 
after temporarily releasing the call (disconnecting the line) . This a second 
problem inherent in the conventional accounting system. Note that the second 
problem is conspicuous especially when executing a "call waiting function" . More 
specifically, the call waiting function provided presently as a line switching 
added service of OSI protocol layer-3 is a function that an in -communications user 
holds an in- communications call and simultaneously reply to a new call-in when the 
user receives a call-in notice and, further, make switchable both of the in- 
communications call and an in-hold call. Then, according to the conventional 
accounting system, even when a call of the user whom the communication service 
charges are imposed on (normally, the originating user but the receiving user) when 
using the collect call services is held due to the call waiting function, the user 
has to accept the burden of the communications network service charges during the 
hold due to some convenience of the partner user. This is irrational. Even in this 
case, the accounting specification can be changed if the call is reset by releasing 
the call (disconnecting the line) . If done so, however, there arises a 
contradiction that a significance of introducing the call waiting services 
disappears . 

Brief Summary Text (13) : 

The accounting method and system according to the present invention has been 
devised under such circumstances. According to one aspect of the present invention, 
there is provided an accounting system of communication charges for communications 
between a first terminal and a second terminal connected to each other via a 
communications network . According to the accounting system, when changing 
information requesting that an accounting rate between the respective terminals 
with respect to the communication charges is changed to a given rate is transmitted 
from one terminal to the communications network in the middle of communications, 
the communication charges after transmitting the changing information are imposed 
on one terminal and/or the other terminal in accordance with the given rate. 

Brief Summary Text (14) : 

The terminal includes a telephone, a facsimile, a computer, etc. Particularly when 
the communications network is a digital communications network, the terminal may be 
a digital telephone capable of transmitting even video information. Note that one 
of the first and second terminals is an originating terminal, while the other 
terminal is a receiving terminal. The originating terminal is a terminal making a 
call setting request, while the receiving terminal is a partner terminal receiving 
the call setting request. 

Brief Summary Text (15) : 

The communication charges include line service charges, talk charges, added value 
service charges, etc.. Further, in connection with a method of calculating the talk 
charges, if a system for connecting the respective terminals is a constant 
connection system, the charges may be calculated based on a communications time. If 
the connection system of the respective terminals involves packet switching, a 
frame relay or a cell relay, the charges may be calculated based on the number of 
packets, frames or cells. The request for setting the accounting rate of the 
communication charges may be accepted when setting the call. That is, the rate of 
charges may be determined even at the start of communications. If not so, the 
charges are automatically imposed on the originating terminal and/or the receiving 
terminal in accordance with a predetermined rate when setting the call. All the 
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communication charges may be imposed on the originating terminal or on the 
receiving terminal as a variation in terms of the accounting rate. The 
communication charges may also be imposed on both of the originating terminal and 
the receiving terminal at a fixed rate. The changing information requesting the 
change of the accounting rate may be transmitted from either the originating 
terminal or the receiving terminal but may also be transmitted from only the 
originating terminal or the receiving terminal. Further, in the communications 
service added with the call waiting function, the request for holding the call can 
be conceived as a piece of information requesting the change of the accounting 
rate. In this case, all the charges can be always imposed on the terminal making 
the request for holding the call. When the changing information requesting the 
change of the accounting rate is transmitted from one terminal to the 
communications network, the charges may be imposed at all times in accordance with 
a rate contained in the changing information. Alternatively, after notifying the 
other terminal of the rate, and only when the other terminal agrees to this rate, 
the charges may also be imposed thereon in accordance with the rate. In the latter 
case, if the other terminal does not agree to the relevant rate, and when the other 
terminal transmits an item of information requesting a change to a different rate, 
the charges may be imposed based on the rate contained in the information 
transmitted by the other terminal. Note that this different rate is termed a 
modified rate. 

Detailed Description Text (4) : 

FIG. 2 shows an outline of the accounting system in accordance with this embodiment 
carried out in the communications system having the above schematic construction. 
To be specific, a communication charge for the relevant call is imposed on the 
originating terminal Tl and/or receiving terminal T2 in accordance with a rate 
determined when setting the call by some means. In the middle of the communications 
by this call (step ST1) , one terminal described above transmits, to the 
communications network, a piece of changing information requesting that an 
accounting rate of the communication charge between the respective terminals is 
changed to a given rate (step ST2) . Then, the communications network imposes the 
communication charge after the above information has been transmitted upon one 
terminal and/or the other terminal in accordance with the given rate (step ST3) . 

Detailed Description Text (75) : 

If the accounting rate is not set (when the "ACCOUNTING DESIRED RATE" window 16 can 
not be opened) , a call is set as it is between the originating terminal Tl and the 
receiving terminal T2 . The talk between the two users takes place in accordance 
with a normal operation (step S13) . In this case, charges for services of the 
communications network are all imposed on the originating user. Note that an 
interruption of processing of FIGS. 24 and 25 can be done for a duration of even 
the normal operation. 

Detailed Description Text (78) : 

Namely, if the receiving user agrees to the sharing request, the receiving user 
inputs the function key "YES" 18 and raises the handset 14. Hereupon, the call is 
set between the originating terminal Tl and the receiving terminal T2 , thus making 
the communications serviceable (step S07) . The charges for services of the 
communications network in this instance are imposed at a rate desired by the 
originating user. Afterward, when the talk comes to an end (step S08) , the 
accounting information is displayed on the display screens 13 of the originating 
terminal Tl and of the receiving terminal T2 as well (step S09) . Then, this flow of 
procedures is finished. 

Detailed Description Text (80) : 

Whereas if the receiving user talks in step S10, the receiving user inputs a self- 
desired accounting rate in the numeral input portion 19 of the "RECEIVED" window 16 
and raises the handset 14 (step Sll) . Hereupon, the call is set between the 
originating terminal Tl and the receiving terminal T2, and the communications 
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become serviceable (step S07) . The charges for services of the communications 
network in this instance are imposed at a rate desired by the receiving user. Note 
that 00% is set as an initial value in the numeral input portion 19 of this 
"RECEIVED" window 16. Accordingly, if the receiving user rejects the accounting 
share, the receiving user may raise the handset 14 without changing the setting of 
the numeral input portion 19 in step Sll. The charges for services of the 
communications network in this case are all imposed on the originating user. When 
finishing the talk (step S08) , the accounting information is displayed on the 
display screens of both of the originating and receiving terminals (step S09) . 
Then, this procedure comes to an end. 

Detailed Description Text (82) : 

Next, the procedures are made variable depending on whether or not this partner 
user agrees to the sharing request (step S18) . Namely, if the partner user agrees 
to the sharing request, the partner user inputs the function key "YES" (step S19) . 
Then, the next procedure proceeds to step S07. Charges for subsequent talks by 
using the communications network are to be imposed at a rate presented. 

Detailed Description Text (83) : 

Contrastingly, if the partner user does not agree to the sharing request in step 
S18, the procedure is made variable depending on whether or not this partner user 
requests the change of the accounting rate (step S20) . That is, if the partner user 
requests the change in the accounting rate, this partner user inputs a self-desired 
accounting rate (step S21)o Then, the next procedure proceeds to step S07 . The 
charges for subsequent talks by using the communications network are to be imposed 
at the rate presented by the partner user. 

Detailed Description Text (84) : 

Whereas if the partner user does not request the change in the accounting rate in 
step S20, this partner user does not input the function key 18 at all. Then, this 
interrupt processing of FIG. 24 comes to an end, and, thereafter, the procedure 
returns to the original processing position. In this case, the charges for services 
of the communications network are imposed the same as the accounting theretofore. 

Detailed Description Text (88) : 

In any case, next, the talk between the originating terminal Tl and the receiving 
terminal T2 is held, and a call corresponding to a call setting message given from 
other user is set (step S26) , The charges for services of the communications 
network during this hold are imposed on the receiving user when passing through 
step S25 but imposed the same as before when passing through step S28. 

Detailed Description Text (90) : 

When the receiving user depresses the hook, the next procedure proceeds to step S07 
of FIG. 23, and the talk becomes effective. The charges for services of the 
communication network in after are imposed the same as the one that is used before 
the holding. 

CLAIMS : 

1. An accounting method of communication charges for communications between a 
plurality of terminals connected to each other via a communications network, the 
accounting method comprising the steps of: 

transmitting a first information indicating that an accounting sharing rate between 
respective terminals with respect to the communication charges is changed from a 
first sharing rate corresponding to an accounting sharing rate used for accounting 
the communication charges between the respective terminals prior to said 
transmitting step, to a second arbitrary sharing rate, from one terminal of said 
respective terminals to said communications network, at arbitrary timing in the 
middle of the communication; 
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detecting the transmission of the first information; and 

imposing the communication charges for a communication after detecting the 
transmission of the first information, on at least one of said one terminal and 
another terminal of said respective terminals in accordance with the second sharing 
rate . 

2. An accounting method according to claim 1, further comprising the steps of: 

transmitting the first information from said communications network to said another 
terminal; and 

imposing the communication charges after the first information has been transmitted 
on at least one of said one terminal and said another terminal in accordance with 
the second sharing rate only when a second information indicating an agreement on 
the second rate is transmitted from said another terminal to said communications 
network . 

5. An accounting method of communication charges for communications between a 
plurality of terminals connected to each other via a communications network, the 
accounting method comprising the steps of: 

detecting that information indicating a hold of a communication with a connection 
through said communications network maintained, is transmitted from one of said 
terminals to said communications network, in the middle of the communication; and 

imposing all the communication charges after detecting the transmission of the 
information on said one of said terminals. 

6. An accounting method according to claim 5, wherein said communications network 
holds the communications between a first terminal and a second terminal with a 
connection of the first terminal and the second terminal maintained when a third 
terminal makes a request for performing the communication with one of said first 
and second terminals during an execution of the communications between said first 
terminal and said second terminal, and, at the same time, said communications 
network connects said one of said first and second terminals to said third terminal 
and makes the communications between said connected terminals serviceable. 

9. A communications system comprising: 

a communications network ; and 

a terminal, 

said terminal including: 

(a) setting means for setting a sharing rate at which charges for communication 
with other terminal are shared; and 

(b) first transmitting means for transmitting a first information about a charge 
sharing rate set by said setting means to said communications network at arbitrary 
timing in the middle of the communications, said charge sharing rate being 
arbitrary; 

said communications network relaying the communication between said terminal and 
said other terminal, imposing the charges for the communication between said 
terminal and said other terminal on at least one of said terminal and said other 
terminal and, upon receiving said first information about the charge sharing rate 
from said terminal, imposing the charges for the communication on the basis of the 
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received charge sharing rate . 

10. A communications system according to claim 9, wherein said communications 
network transmits, upon receiving the first information about the charge sharing 
rate from said terminal, the first information to said other terminal. 

11. A communications system according to claim 10, wherein each said terminal 
includes : 

displaying means for displaying, when the first information about the charge 
sharing rate transmitted from said communications network is received, the charge 
sharing rate; 

inputting means for inputting a second information indicating whether there is an 
agreement on the charge sharing rate between said one and other terminals; and 

second transmitting means for transmitting the second information inputted from 
said inputting means to said communications network, and 

wherein said communications network imposes the communication charges on the basis 
of the charge sharing rate only when the second information transmitted from said 
terminal indicates an agreement on the charge sharing rate . 

12. A communications system according to claim 11, wherein said communications 
network imposes, when said other terminal rejects an agreement on the charge 
sharing rate transmitted from said one terminal and when the charge sharing rate 
set by said other terminal is transmitted from said other terminal to the 
communications network, the charges on the basis of the charge sharing rate 
transmitted from said other terminal. 

13. A terminal station, connected to a communications network and comprising: 

(a) setting means for setting a sharing rate at which charges for communication of 
one terminal with another terminal are shared; and 

(b) transmitting means for transmitting information about the charge sharing rate 
set by said setting means to said communications network at arbitrary timing in the 
middle of the communication; 

said terminal station imposing charges for the communication on the basis of the 
charge sharing rate received by said communications network, on at least one of 
said one terminal and said another terminal, upon reception of said information 
about the charge sharing rate from said terminal station by the communications 
network, said charge sharing rate being arbitrary. 
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ABSTRACT : 

A personal communications internetwork provides a personal communications 
internetwork providing a network subscriber with the ability to remotely control 
the receipt and delivery of wireless and wireline electronic text messages. The 
network operates as an interface between wireless and wireline networks. The 
subscriber's message receipt and delivery options are maintained in a database 
which the subscriber may access by wireless or wireline communications to update 
the options programmed in the database . 

3 Claims, 32 Drawing figures 
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TITLE: Electronic massaging network 

Brief Summary Text (5) : 

The messaging options described above are available to businesses of all sizes, as 
well as individual users, from a variety of service providers. Many offices have 
some or all of the messaging options described above. The office may have certain 
messaging equipment (referred to as "consumer premises equipment" or "CPE") 
connected to one or more wireline networks. That is, the office may have 
telephones, fax servers, and voice mail systems connected to phone lines, and 
computers having modems for e-mail connected to packet networks which are connected 
via phone lines. The mobile employee may have certain wireless messaging equipment, 
such as a pager, a cellular telephone, or a personal digital assistant ("PDA"), 
which is typically a notebook computer connected to a wireless communication 
network . 

Detailed Description Text (25) : 

A mobile communications subscriber (for example an employee who works at the office 
described above and travels frequently) has various portable messaging equipment, 
such as a PDA 30, a cellular phone 32, and a pager 34. These are connected to 
wireless networks 39. These wireless messaging options may be provided by different 
service providers. That is, the cellular phone may be connected to a wireless 
network of a cellular phone service provider, the pager may be connected to a 
different wireless network maintained by a pager service provider, and the PDA may 
be connected to a third wireless communications network maintained by yet another 
service provider. 

Detailed Description Text (115) : 

Communication between the PDA and PCI use, for example, an X.25 transport using the 
UDP IP protocol. A brief discussion of the PDA structure is provided. The PDA 30 is 
preferably a notebook or palm top computer having a wireless network interface. The 
PDA may be, for example a Hewlett Packard Omnibook 300 notebook computer running a 
PCI application. FIG. 11 illustrates an exemplary PDA. The PDA 30 has a central 
processing unit 295 connected to a bus B. The central processing unit ("CPU") 295 
performs most of the computing and logic functions of the PDA 30. A memory 296 is 
connected to the bus B, which stores information to be provided to the CPU 2 95 or 
otherwise used by the PDA 30. An input/output device 297, such as a keyboard, is 
also connected to the bus B which allows a user to input data for storage in memory 
2 96 or for use by CPU 2 95. A display 2 98 is connected to the bus B. The PDA 3 0 also 
has a wireless communication interface 299 for communication with a wireless 
communication network . 

Detailed Description Text (192) : 

Billing operations is supported by an Automatic Message Accounting Network 
Function. The automatic network accounting measures, collects, formats and outputs 
network usage information to upstream billing and other operation application and 
service purposes. Preferably, automatic message accounting data is collected at 
various stages of service flows across network equipment and services. 
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ABSTRACT : 

The invention features a system and method to enable real-time establishment and 
maintenance of a standard of operation for a data communications network . The 
standard is a data set which includes network activity which is historically 
categorized by traffic type and by activity. The process begins with monitoring the 
network media or some network component over some period of time. The monitoring 
information is used to build benchmark data sets. The benchmark data sets contain a 
standard of operation for the network, which are historically categorized by either 
traffic type or activity. This standard of operation is constantly built by the 
intelligent monitoring facilities. After some period of time which is referred to 
as the benchmark data set refresh interval, the benchmark that was created is 
employed in a fashion to allow a determination as to whether the data that is taken 
from the current monitoring activity indicates normal network behavior. If the 
current network operating characteristics are outside the bounds or normal 
behavior, then alerts and logs of information can be sent to the expert system. The 
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expert system can then effect some network control. In this manner, auto 
benchmarking is accomplished with self customization. 

18 Claims, 24 Drawing figures 
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TITLE: Intelligent realtime monitoring of data traffic 



Abstract Text (1) : 

The invention features a system and method to enable real-time establishment and 
maintenance of a standard of operation for a data communications network . The 
standard is a data set which includes network activity which is historically 
categorized by traffic type and by activity. The process begins with monitoring the 
network media or some network component over some period of time. The monitoring 
information is used to build benchmark data sets. The benchmark data sets contain a 
standard of operation for the network, which are historically categorized by either 
traffic type or activity. This standard of operation is constantly built by the 
intelligent monitoring facilities. After some period of time which is referred to 
as the benchmark data set refresh interval, the benchmark that was created is 
employed in a fashion to allow a determination as to whether the data that is taken 
from the current monitoring activity indicates normal network behavior. If the 
current network operating characteristics are outside the bounds or normal 
behavior, then alerts and logs of information can be sent to the expert system. The 
expert system can then effect some network control. In this manner, auto 
benchmarking is accomplished with self customization. 

Brief Summary Text (6) : 

This invention is related to the copending U.S. patent application Ser. No. 
08/024,542, now U.S. Pat. No. 5,365,514 filed May 1, 1993 by J. G. Waclawsky, et 
al., entitled "System and Method for Configuring an Event Driven Interface and 
Analyzing Its Output for Monitoring and Controlling a Data Communications Network, 11 
assigned to the IBM Corporation and incorporated herein by reference. The 
Waclawsky, et al . patent application describes an information collection 
architecture which allows the conversion of signals in a data communications 
network bit stream, to be fed back into a monitoring and controlling system to 
assess and to modify protocol activity for a variety of communications protocols. 
The protocols handled include Token Ring protocol, ETHERNET protocol, Fiber 
Distributed Data Interface (FDDI) protocol, System Network Architecture (SNA) 
protocols, TCP/IP protocols, and SONET protocol, among others. 

Brief Summary Text (7) : 

An example of this is for a token ring performance architecture described in 
greater detail in copending U.S. patent application Ser. No. 08/024,575, now U.S. 
Pat. No. 5,375,070 filed Mar. 1, 1993 by P. C. Hershey, et al . entitled "Event 
Driven Interface for a System for Monitoring and Controlling a Data Communications 
Network, " assigned to IBM Corporation and incorporated herein by reference. This 
reference describes an expert system driven implementation that constructs a 
control vector C{i) which is transmitted to a programmable performance vector 
generator which includes an Event Driven Interface (EDI) . The control vector tells 
the EDI how to organize its logic trees based on the type of protocol being run on 
a network. The control vector will configure the EDI logic trees to perform digital 
filtering of binary bit sequences on the network which characterize the protocol, 
the performance, and from which problem determination information can be inferred. 
The expert system will specify a format for an event vector E(i) that will be 
generated by the Event Driven Interface within the Programmable Performance Vector 
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Generator (PPVG) , that will provide the requested information characterizing the 
current condition of the network. The expert system then analyzes the information 
in the event vector and drives control functions which enable control signals to be 
issued to the network to modify network load, perform load balancing and load 
distribution, do problem determination, modify network routing, or to provide other 
customer services. The expert system can issue control vectors C(i) to collect 
additional information to perform problem determination and analysis to identify 
and analyze temporary failures and performance degradation on the network. The 
expert system can perform performance monitoring to identify when a performance 
factor of a network component exceeds a predefined threshold. The expert system can 
perform benchmark testing of an application running on the network with respect to 
its functions, reliability and performance objectives. The expert system can 
initiate performance tuning and optimization of the network to improve the 
efficiency of the network or other network components. The expert system can 
perform a workload analysis and prepare a report to identify both application and 
protocol-related workloads, i.e., how much network traffic is useful information 
and how much is protocol -related, where the noisiest nodes are in the network and 
the amount of incoming and outgoing traffic flow to the network. The expert system 
can provide network sizing information to guarantee a workable solution for a 
particular customer application, based upon forecast traffic patterns. The expert 
system can provide input information for load balancing, load distribution and 
network control. The principle of operation of the expert system and Programmable 
Performance Vector Generator combination is also applied, to additional 
communications protocols such as Ethernet protocol, FDD I protocol, SNA protocols, 
TCP/IP protocols or the SONET protocol. 

Brief Summary Text (8) : 

The invention finds application within the Information Collection Architecture 
which is further described in the above referenced Waclawsky, et al . patent 
application. The Information Collection Architecture extracts information 
characterizing all data communications network environments, especially those that 
are high speed and/or complex network environments. The Information Collection 
Architecture is an enabler that provides a unique physical layer based window into 
both physical and logical network activity. It can significantly improve the 
functions, and services and management of any data communications network . It is 
independent of communications protocols, standards, and physical media. The 
Information Collection Architecture invention is physically connected to an 
existing data communications network to monitor the high speed messages which are 
transferred over the network. The Information Collection Architecture includes a 
feedback connection which can be used to provide control signals back to the data 
communications network to modify the behavior of the network in response to 
monitoring data messages on the network. The Information Collection Architecture 
performs the functions of real-time identification of events which occur on the 
network and prepares summaries of correlated event behavior from the network. The 
Information Collection Architecture provides correlated data and does not go 
through any data decompression or reconstruction process. This differs from prior 
techniques of data compression and sampling. The Information Collection 
Architecture invention performs an examination of only the frequency of occurrence 
of selected bit patterns, unlike prior trace techniques which require processing 
for the examination of all network data to determine performance metrics. The 
Information Collection Architecture permits all traffic to be monitored so that no 
information goes unseen, which is distinct from prior filtering techniques which 
permit only a portion of the network traffic to reach the network monitor for 
analysis. The Information Collection Architecture includes an organized collection 
of hybrid data reduction vectors and their associated services. These services 
include performance monitoring, performance tuning and optimization, benchmarking, 
problem determination, workload analysis and reporting, network sizing, load 
balancing, load distribution, network control, network accounting and network 
management functions. These services are provided for a large variety of data 
communications networks. 
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Brief Summary Text (9) : 

It would be useful to provide a means for establishing benchmarks for the behavior 
of data communications networks so that valid criteria can be made available to the 
expert system of the Information Collection Architecture to enable the monitoring 
and controlling of the data communications network based upon relevant standards of 
behavior for the network. 

Brief Summary Text (11) : 

It is an object of this invention to provide a technique for realtime monitoring of 
data communication networks . 

Brief Summary Text (12) : 

It is still another object of the invention to provide an improved technique for 
the display of the results of realtime monitoring of a data communication network . 

Brief Summary Text (14) : 

These and other objects, features and advantages are accomplished by the invention. 
The invention uses the Event Driven Interface described in the above cited Hershey, 
et al . patent application to deliver event vectors to the realtime intelligent 
monitoring system for monitoring the behavior of a data communications network to 
which it is coupled. The intelligent realtime monitoring system removes the need 
for process and storage at the data collection point. An event vector is 
accumulated at the data collection point and is transmitted over communications 
link to the intelligent realtime monitoring system where it is processed and 
displayed for analysis and network control. The resulting realtime monitoring 
invention enables the expert system to respond in realtime to deviations in the 
behavior of the data communications network from norms established by benchmark 
data sets. It also enables the system administrator to perform realtime monitoring 
and reacting in response to events which are displayed representing events 
occurring on a data communications network . 

Detailed Description Text (2) : 

The invention is a method and system to enable realtime establishment and 
maintenance of a standard of operation for a data communications network . The 
standard is a data set which includes network activity which is historically 
categorized by traffic type and by activity. 

Detailed Description Text (3) : 

FIGS. 1A and IB describe the overall functional organization of the invention, FIG. 
1A concentrates on the automated benchmarking with a self -customization feature and 
FIG. IB focuses on the Intelligent Realtime Monitor feature. In FIG. 1A it is seen 
that the Event Driven Interface of the information collection architecture monitor 
100 which is connected to the communications network being monitored, accepts event 
vectors which are transferred to the buffer array 140. Reference to Table 1 will 
illustrate example event vectors such as those which are generated by the Event 
Driven Interface described in the copending U.S. patent application Ser. No. 
08/024,575, now U.S. Pat. No. 5,375,070 filed Mar. 1, 1993, which is cited above. 
The event vectors shown in Table 1 characterized batch traffic which starts and 
stops using the size and the frame rates and queuing status using the maximum 
frames per rotation (MFR) column. It can be seen in Table 1 that at line A, the 
number of frames is 682 and the maximum frame size is 103 bytes whereas at line B 
which is many minutes later in time, shows the number of frames being over 6000 and 
the maximum frame size being over 1000 bytes. Line B is near the middle of a burst 
of batch traffic that has been detected in the network. This is just one of many 
examples of the kind of information which is provided by the event vectors which 
are input to the buffer array 140. The buffer array 140 then outputs information 
derived from the event vectors to the accumulator storage 23 0 in the customized 
benchmark manager 195. The information from the event vectors is also output from 
the buffer array 140 to the expert system analysis module 160. The output from the 
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buffer array 140 is also applied to the Intelligent Realtime Monitor 199 shown in 
FIG. IB. 

Detailed Description Text (17) : 

FIG. 2 illustrates building an example benchmark data set structure, in accordance 
with the invention. The benchmark data set structure (BDS) 110 shown in FIG. 2 is 
an example which covers a duration 12 of one week, from midnight Sunday morning 
until the following midnight Sunday morning. The benchmark data set 110 includes 
consecutive one hour sample segments which are referred to as the benchmark 
interval information, which are taken over the interval 13, which in this example 
is one hour in duration. During each one hour interval, data has been collected 
from the event vectors generated by the Event Driven Interface in the data 
communications network . The data from the event vectors is characterized as Al, A2 , 
A3 ... in FIG. 2. An example of the type of information which can be accumulated 
during the one hour interval, is Al can be the percent utilization which can be 
characterized as the maximum percent, minimum percent and average percent 
utilization which has been observed during the one hour interval Tuesday at 9:00 
a.m. This information is collected in realtime by the Event Driven Interface and 
output as an event vector E(i) which is supplied by the monitor 100 shown in FIG. 
2. As the information for the one hour segment is accumulated, it can fill a buffer 
23 0 which is set up for the accumulation of information to be placed in the 
benchmark data set 110 by the customizing benchmark manager shown as 195 in FIG. 8 
and FIGS. 1A and IB. Other categories of information can include priority values 
observed for messages on the network and this is characterized in FIG. 2. Still 
other categories can be, for example, the number of bytes of information observed 
for particular applications having packets communicated on the network during the 
hour interval, and this would be accumulated in another category such as A17. 
Information which is accumulated in realtime will be incorporated into the 
appropriate benchmark data set that is also being buffered for future use. The 
benchmark data set in this example would have its component data accumulated for 
consecutive one hour benchmark collection intervals for an entire week 12 . The 
completed buffered information in the benchmark data set for a week can then be set 
aside until a future time II at which it will be invoked as the set of benchmark 
standards for use as benchmark 120 in FIGS. 1A and IB. 

Detailed Description Text (19) : 

FIG. 2 shows how the monitor 100 can be applied in this example to take 30 second 
samplings of duration 15 of event vectors E(i) from the Event Driven Interface 
which is monitoring the data communications network in realtime. Each consecutive 
60 second sampling interval 14 can be stored as is shown in FIG. 2 so that a total 
of 60 consecutive one minute sampling intervals are stored and the monitoring will 
progress as is shown in FIG. 2 for a duration of one hour. 

Detailed Description Text (22) : 

In this example of the invention, the first BDS 120 can represent normal data 
network operations, the second BDS 12 0' can represent other BDS categories which 
can include batch traffic, interact ive traffic, voice traffic, video traffic, 
accounting information, packet sizes, etc. In accordance with the invention, as the 
realtime event vectors E(i) are applied from the Event Driven Interface to the 
register 140 in FIG. 3, they are consecutively compared with the corresponding time 
interval segment 210 for BDS 120 in the first criteria module 150. From this 
comparison an inference can be drawn as to whether the data communications network 
is operating within the limits characterized by the segment 210 in the BDS 120 or 
whether it is outside those limits. The expert system 160 will perform this 
analysis and will issue an alert 180 which can result in network control 170 
issuing control signals to the network to modify its operating parameters where 
necessary, in order to maintain a desired network throughput. Alternately, if the 
expert system 160, using the first criteria module 150, determines that the 
character of the traffic currently on the network is qualitatively different from 
the kind of traffic characterized by the BDS 120, then the expert system 160, in 
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accordance with the invention, can apply a different criteria module, such as the 
module 150'. For example, if the expert system 160, in analyzing the event vectors 
in 140, determines that instead of having a normal mixture of traffic on the 
network for the current one hour segment, there is instead a large volume of low 
priority traffic, then an inference can be drawn that the network is communicating 
batch mode traffic. Then in accordance with the invention, the expert system 160 
can switch to the second BDS (BDS2) 120' and use the second criteria module 150', 
which in this example, characterize batch mode traffic. Then by using the second 
BDS 120' and the second criteria module 150', the system can measure whether the 
network is exceeding the operating limits established by the benchmark collection 
interval 210' for the second BDS2 120*. 

Detailed Description Text (24) : 

In this manner, great flexibility is provided in the application of benchmark 
information to the monitoring analysis and network control of a data communications 
network which has been previously characterized by the accumulation of benchmark 
data from past event vectors generated by the Event Driven Interfaces in the data 
communications network . 

CLAIMS : 

I. In a system for intelligent real time monitoring of a data communications 
network which communicates using a serial stream of binary bits having 
characteristic patterns, a method for outputting monitoring and controlling signals 
which are customized by classes of traffic on the network, comprising: 

inputting one or more event vectors from an Event Driven Interface coupled to a 
data communications network ; 

storing a first criteria of rules in said system for a first class of traffic in 
said network with a standard for said first class of traffic in said network; 

storing in said system a first benchmark data set as said standard for said first 
class of traffic, said first benchmark data set being derived from previously 
monitored events of said first class of traffic in said network; 

accessing said first criteria of rules and comparing information derived from said 
inputted event vectors with said standard for said first class of traffic, using 
said first criteria of rules; 

outputting an inference signal in response said comparison to manage and control 
said first class of traffic on said network; 

displaying a graphical representation of the behavior of the first class traffic 
using the inference signal for said first class of traffic. 

II. A system for intelligent real-time monitoring using an event driven interface 
for analyzing the output of a data communications network which communicates using 
a serial stream of binary bits having characteristic patterns, comprising: 

an event vector register coupled to the event driven interface, for receiving event 
vectors that characterize the behavior of the data communications network, each 
event vector descriptive of one or more classes of traffic occurring on the data 
communications network ; 

an expert system, having an input coupled to said event vector register, for 
receiving information from said event vectors, said expert system having one or 
more criteria modules, each criteria module associated with a class of traffic and 
a standard for said associated class of traffic, each criteria module having rules 
for characterizing the traffic on the network by comparing information represented 
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by the event vectors with a standard of behavior associated with the class of 
traffic associated with the criteria module; 

said expert system outputting one or more inference signals, each inference signal 
associated with a class of traffic on the network; and 

an intelligent real-time monitor that outputs signals to said data communications 
network in response to said inference signals to mange and control said classes of 
traffic in said data communications network and displaying a specific graphical 
representation of each inference signal based upon the associated class of traffic. 
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a tariff is distributed via the network to customer terminals. At each terminal a 
charge for use of the network is calculated by using the tariff. Different tariffs 
may be communicated for different services and a respective tariff may be varied 
depending upon the operational condition of the service. Different tariffs may be 
calculated for different customers and the tariffs may be varied in dependence upon 
the loading of network resources and different tariffs may have different 
volatilities. Part of the traffic from a user to the network may be sampled and the 
status of the user may be amended when a discrepancy is detected between the 
sampled parameters and the contracted parameters in the users contract . 
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TITLE: Method and apparatus for extending a relational database management system 
using a federated coordinator 

Detailed Description Text (12) : 

The federated coordinator 206 comprises a session management/plan generation module 
236 which handles all aspects of primary sessions between clients 220 and the host. 
The session plan/generation module 236 also accepts requests from clients 220, and 
transforms them into execution plans which are executed by the RDBMS 210 and the 
object servers 212, 214, and 216, performs database administration, establishes 
sessions with the client 220 (including maintaining accounting information and 
termination) , and interprets client SQL or CLI requests and transforms them into 
execution plans . 

Detailed Description Text (16) : 

Internal messaging communications are provided through internal messaging data 
paths between the federated coordinator 2 06, the virtual network 208, and the RDBMS 
210, object server 212, and auxiliary object server 214. Since large object data 
instances are not transmitted via these paths, they also need not offer high 
bandwidth communications. 

Detailed Description Text (62) : 

If the client command was a select command, object data associated with a MOL is 
obtained from the object server 212, and provided to the requesting client 220 or 
to a receiver client 258. First, the requested data is obtained 410 using the 
answer set from the RDBMS 210, and if the client requests actual object data 412, 
that data is sent 444 to the selected client via the virtual network 218. FIG. 4g 
presents a flow chart illustrating the process of obtaining 410 an answer set 
responsive to the select command, associating the resulting data with a MOL 410. 
First, a query plan is formulated 434. The query plan is an optimized set of 
commands which will be distributed to the RDBMS 210 and the object server 212 to 
obtain the desired data. FIG. 4h describes how the query plan is formulated. First, 
the M-SQL commands are parsed 512, resolved 514, checked to assure that access to 
the indicated database is authorized 516, and optimized 518. Next, the optimized 
plan is used to generate 520 the query plan. The process of parsing the query plan 
is described in FIG. 4i. First, the federated coordinator 206 obtains schema, 
network, and security information from the global data dictionary, which is stored 
in the RDBMS 210. This information provides the federated coordinator 206 with the 
building block information it needs to parse the M-SQL commands. Next, this 
information is used to transform 524 the M-SQL commands into a parse tree of 
objects, as described earlier. Items in the parse tree are then resolved 514. This 
is accomplished as shown in FIG. 4j . Eventually the query plan must be optimized 
according to a set of criteria established by the client 220 or other entities. To 
perform this optimization, costs for the various alternative plans must be 
obtained. These costs include both static and dynamic costs. Static costs are 
obtained from the GDD 526. Derived costs depend on the execution path chosen, and 
must be calculated 52 8 on the go. After the derived costs are calculated 52 8, they 
are bound to the parse tree nodes 530, and by iteration, these parse tree nodes are 
used to derive an optimized execution plan 532. This optimized plan is then used to 
generate the query plan, which comprises RDBMS 210 SQL commands and M-Step 
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end-user and Internet sites (18) accessed by 
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ule (58). such as a "JAVA" applet, resides on 

an originating station (24). such as a personal 

computer, operated by the end-user. The su- 
pervisory program module (58) may be acti* 

vated by transmitting the supervisory program 

module to the originating station (24) from an 

Internet point of presence (22) operated by u 

local access provider. Alternatively, a trigger 

may be transmitted from the point of presence 

(22) to the originating station (24) to activate 

a supervisory program module (58) already re- 
siding on the originating station (24). The su- 
pervisory program module (58) monitors the 
duration of connections with specific Internet 
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connections. The local access provider uses 
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allocare a cost associated with the access, such 
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net sites accessed by the end-user. Unique 
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